Privacy Policy
Privacy Policy
Effective date: July 11, 2026
TravelGrab ("TravelGrab," "we," "us," or "our"), operated by Nolan Watts and Max Alonso, provides an AI-assisted travel planning service at travelgrab.ai (the "Service"). This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have.
By using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.
Note: This document is a good-faith description of our current practices. It is not legal advice. If you have questions about your rights, you may contact us at the address below.
1. Who we are and how to contact us
TravelGrab is operated by Nolan Watts and Max Alonso, based in California, United States.
For any privacy question, or to request access to or deletion of your data, contact us at:
2. Information we collect
We aim to collect as little personal information as possible. Specifically:
Account information. When you create an account, we collect your email address and password. Passwords are handled by our authentication provider (Supabase) and stored in hashed form; we do not store or see your plaintext password. We do not collect your name, phone number, or use third-party sign-in (such as Google login).
Trip and itinerary information. When you use the planning features, we store the trip details you provide, which may include: destination, travel dates, number of travelers, dietary restrictions, a general "traveling with children" indicator (a coarse category — we do not collect the specific ages of children), free-text preference notes you type, and the flights, hotels, and activities you select or save. This trip information is associated with an anonymous device identifier rather than your account.
Analytics information. We use PostHog to understand how the Service is used. This collects behavioral data such as pages viewed, clicks, and interactions with features, tied to an anonymous identifier. We have configured PostHog to discard IP address data, and we do not link analytics events to your account email.
Affiliate information. On flight, hotel, activity, and itinerary pages, we participate in an affiliate program through Travelpayouts. Travelpayouts loads scripts on these pages that set their own cookies and collect interaction, click, and referral data (and, on their servers, standard request data such as IP address and browser type) to attribute booking commissions. This does not run on our landing or sign-in pages. See Travelpayouts' own privacy policy for details on their practices.
Cookies and similar technologies. We use a limited number of cookies and browser storage:
- An access cookie to manage entry to the Service.
- PostHog analytics cookies (anonymous).
- Travelpayouts affiliate cookies, only on booking-related pages.
- Your login session, stored in your browser's local storage by our authentication provider.
3. Information we do NOT collect
To be clear about what we do not do:
- We do not collect or process payment or credit card information. Bookings are completed on third-party sites; we never handle your payment details.
- We do not collect your precise (GPS) location.
- We do not collect dates of birth or the specific ages of children.
- We do not sell your personal information, and we do not share it with advertisers or data brokers. We use no advertising pixels or marketing trackers.
4. How we use your information
We use the information we collect to:
- Provide and operate the Service, including generating and saving trip plans.
- Authenticate you and maintain your account.
- Understand and improve how the Service is used (analytics).
- Attribute affiliate bookings so we can earn commissions that support the Service.
- Respond to your requests and communicate with you about the Service.
Automated / AI processing. To generate itineraries and recommendations, we send trip context (such as destination, dates, and preferences) to third-party AI and search providers, including Anthropic (Claude) and Google. We do not send your account identity (email, password, or user ID) to these providers.
5. Who we share information with
We share information only with service providers that help us operate the Service, and only as needed for them to perform their function:
| Provider | Purpose | Information involved |
|---|---|---|
| Supabase | Authentication and data storage | Account email, hashed password |
| Vercel | Hosting | Standard request data (e.g., IP, browser) |
| PostHog | Analytics | Anonymous behavioral events (IP discarded) |
| Anthropic (Claude) | AI itinerary generation | Trip context (no account identity) |
| Google (Maps/Places) | Search and maps | Search queries, request data |
| Duffel / SerpAPI | Flight search | Search terms, request data |
| Unsplash | Photos | Request data on photo loads |
| Travelpayouts | Affiliate attribution | Interaction/attribution data on booking pages |
We may also disclose information if required by law, to protect our rights, or in connection with a merger, acquisition, or sale of assets.
6. Data retention
We retain your account and trip information for as long as your account is active or as needed to provide the Service. You may request deletion of your data at any time (see Section 8). Analytics data is retained according to our analytics provider's default retention settings.
7. Sensitive information
Some information you choose to provide — such as dietary restrictions or free-text preference notes — could reveal sensitive details (for example, about health or religion). Please provide only what you are comfortable sharing. We use this information solely to plan your trip and do not use it for any other purpose.
8. Your rights and choices
You have the right to access, correct, or delete your personal information. Because we are based in California and may have users elsewhere, we honor these rights regardless of where you live, including rights under the California Consumer Privacy Act (CCPA) and, where applicable, the EU/UK General Data Protection Regulation (GDPR).
To request access to or deletion of your account and associated data, email nolan@okwatts.com and we will process your request. We will not discriminate against you for exercising these rights.
You can also delete individual saved trips within the Service.
9. Children's privacy
The Service is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, contact us at nolan@okwatts.com and we will delete it. Note that while trip planning may involve traveling with children, we collect only a general indicator and never the specific ages or identities of children.
10. Security
We use reasonable technical measures to protect your information, including hashed password storage and access controls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. International users
The Service is operated from the United States. If you access it from outside the U.S., your information will be processed in the U.S. and other countries where our service providers operate.
12. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version with a revised effective date. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.
13. Contact
Questions about this Privacy Policy or your data can be sent to: